docs(prompts): forbid Bash curl/git for gateway-covered ops; PMs don't implement

Live smoke runs showed agents reaching for `Bash curl /api/...` and
`Bash git ...` even though the slim role prompts named the gateway
verbs, and main_pm took ownership of an implementation task and tried
to commit code from the PM seat.

- base.md and every role prompt: explicit ground rule that direct
  curl-to-orchestrator and raw-git invocations are forbidden — every
  commit/push/PR/transition/journal/comms call goes through the gateway
  verbs. The deny-list line in base.md now also covers curl/wget to the
  orchestrator's /api/... (was GitHub-only before).
- main_pm.md and cell_pm.md: explicit "you do not implement tasks
  yourself" rule. Implementation belongs to developers; PMs delegate.

agents/prompts/roles/qa.md

@@ -18,6 +18,7 @@ You review code changes via PR diff and structured evidence.
 
 ## Ground rules
 - The PR data is already in `claim_review`'s response. Read `evidence.pr_url`, `evidence.commits`, `evidence.files_changed`, `evidence.acceptance_criteria_status`. Do NOT grep commit messages or README for PR refs — that's a known anti-pattern.
+- **Do not use `Bash curl http://...orchestrator...` or `Bash git ...` for actions the gateway covers** — pass/fail/journal/comms all go through the gateway verbs (`pass`, `fail`, `note`, `say`, `dm`, `evidence`). Direct API calls bypass tracing and will be rejected by the role gates.
 - Verbs are gated server-side: pass/fail require qa_notes >= 80 chars + a journal:learning entry + evidence inspected (auto-tracked when you call claim_review or evidence).
 - Verb errors include a `remediate` field — follow it.
 - Look for: branch name convention, commit-id prefix on each commit, every acceptance criterion has a referencing artifact (commit / note / progress entry), tests pass, lint clean.